Installed GUI Integration

docs/client-registration-installation-runbook.md

@@ -6,8 +6,9 @@
 2. One or more tenant accounts are attached to that registration.
 3. A time-bound license defines package, user, and installation limits.
 4. An activation key is generated, stored only as a BCrypt hash, and emailed.
-5. The Java wizard blocks unless Docker, Docker Engine, and Compose v2 work.
-6. The wizard validates the key, generates an RSA-3072 installation key, and
+5. The Technobee Service Installer blocks unless Docker, Docker Engine, and
+   Compose v2 work.
+6. The installer validates the key, generates an RSA-3072 installation key, and
    registers the installation in one database transaction.
 7. The plaintext activation key is neither returned again nor written locally.
 8. Runtime token issuance requires an active registration, tenant, license, and
@@ -51,27 +52,45 @@ For replacements:
 Both require a non-empty reason, invalidate the cached installation, increment
 its security version, and write an audit event.
 
-## Running the wizard
+## Running the Technobee Service Installer
 
 ```bash
 mvn -pl cygnus-installer -am package
-CYGNUS_CLOUD_URL=https://cloud.example.com \
-java -jar cygnus-installer/target/cygnus-installer-1.0.0-SNAPSHOT.jar
+TECHNOBEE_INSTALLER_CONFIG=cygnus-installer/config/cygnus-installer.ini \
+java -jar cygnus-installer/target/technobee-service-installer-1.0.0-SNAPSHOT.jar
 ```
 
-After a successful run, review the generated `compose.yml`, set
-`CYGNUS_IMAGE`, and start with `docker compose up -d`.
+This opens the Swing installation wizard. Add `--cli` when running on a
+headless server or when the terminal workflow is preferred.
 
-The wizard asks for the output directory. Press Enter to accept
-`CYGNUS_INSTALL_OUTPUT`, which defaults to `./cygnus-installation`. It creates:
+Select Matrix or Cygnus using the INI `product` property. The INI also supplies
+the cloud URL, installation API base path, environment, output directory, and
+the product profile. No cloud URL, route, service name, or filesystem path is
+compiled into the installer workflow.
+
+The installer asks for the Matrix or Cygnus Docker image and writes it to
+`.env` using the selected profile's image variable. After a successful run,
+review `compose.yml` and `.env`, then start with `docker compose up -d`.
+
+The installer asks for the output directory. Press Enter to accept the INI
+`output_directory`. It creates:
 
 - `compose.yml`
+- `.env`
 - `config/installation.yml`
+- `config/machine-assertion.jwt`
 - `config/keys/client-signing-private.pem`
 - `config/keys/client-signing-public.pem`
 
 The generated private key must remain readable only by the service account.
-Never email or copy it to the cloud. The cloud stores only its public key.
+Never email or copy it to the cloud. The encrypted machine assertion and
+private key remain on premises; the cloud receives and stores only the public
+key. The generated service configuration records the returned client ID,
+installation ID/code, cloud URL, assertion path, and key paths.
+
+The installer does not connect directly to PostgreSQL or Redis. Registration,
+license enforcement, and installation identity remain the selected cloud
+service's responsibility.
 
 ## Operational checks